Container and Kubernetes Security Questions

Approach overview (high level)

I would run a layered assessment: control plane, nodes/pods, RBAC, admission controllers, network policies, image provenance, and runtime behavior — combining automated scans (kube-bench, kube-hunter, trivy), manual inspection, and exploitation attempts.

Control plane

• Check API server flags, unauthenticated endpoints, audit logging, etc.
• Verify etcd access controls and TLS; try read-only access to etcd snapshots where permitted.

Node & pod security

• Inspect kubelet settings (anonymous auth, read-only port), hostPath mounts, privileged containers, CAP_SYS_ADMIN.
• Use kubectl exec/attach to test lateral movement; attempt container escape primitives (mounting /proc, abusing ptrace, CVEs).

RBAC

• Inventory ClusterRoleBindings and ServiceAccounts with wide scopes.
• Attempt privilege escalation via impersonation or token theft (read secrets via API).

Admission controllers

• Verify PodSecurity admission, PSP/PSA enforcement, and dynamic admission webhook behavior; bypass misconfigured webhooks.

Network policies

• Map pod-to-pod connectivity (calico/iptables) via port scans from pods; identify permissive all-allow policies.

Image provenance

• Scan images with trivy; check registries for unsigned images, use of latest tags, accessible private registries.

Runtime behavior

• Monitor processes, capabilities, syscalls; test detection by EDR; simulate persistence (create CronJobs/DaemonSets).

Exploit example: permissive PSP / ServiceAccount

• If PSP allows privileged containers or hostPath and a ServiceAccount is bound to cluster-admin, I would:
  1. create a Pod using that SA with hostPath / and privileged true;
  2. mount host filesystem and kubelet credentials (/var/lib/kubelet) to retrieve node creds;
  3. use host namespace or docker/socket to run containers on host, escalate to root and pivot to other nodes or to the API server using stolen tokens.
• If a ServiceAccount has TokenReview or secrets get, I can read other SA tokens and chain to cluster-admin.

Remediation highlights

• Enforce least privilege RBAC, restrict PSP/PSA to non-privileged, disable kubelet anonymous/read-only ports, enable audit logging, sign images, and enforce strict NetworkPolicies and admission webhooks.

Overview
Below are layered hardening controls (host, runtime, orchestration, network) with specific penetration-tester evaluation and bypass techniques — framed for a pentester role.

Host (Node)

• Controls: CIS Linux benchmark, minimal host OS, disk encryption, host-level EDR, kernel lockdown/sysctl hardening, restricted SSH (key-only, bastion).
• Pentest evaluation: enumerate exposed services, attempt SSH brute/privilege escalation (sudo misconfigs, SUID binaries), check for unpatched kernel CVEs, attempt persistence via kernel modules or cron. Bypass: exploit vulnerable kernel or vulnerable systemd units; abuse weak sudoers or misconfigured file permissions to escalate.

Container Runtime

• Controls: use runtime namespaces, seccomp, AppArmor/SELinux, read-only rootfs, drop CAPABILITIES, rootless containers, image signing (Notary/TUF).
• Pentest evaluation: run escape attempts (pivot from container to host) via CAP_SYS_ADMIN, device mounts, FUSE, misconfigured /var/run/docker.sock or CRI socket access; test for writable hostPath mounts. Bypass: exploit exposed socket to create privileged container, exploit weak seccomp profile or kernel container escapes (CVE chaining).

Orchestration (kubelet, API server)

• Controls: RBAC least privilege, API server authn (OIDC), audit logging, kubelet TLS client certs, restrict kubelet read/write ports, PodSecurityAdmission / OPA Gatekeeper, imagePullSecrets.
• Pentest evaluation: enumerate API with kubectl (token harvesting), test RBAC misconfigurations (abuse clusterrolebindings), attempt to exec/port-forward into privileged pods, abuse Admission webhook gaps. Bypass: steal service account tokens from pods, exploit overly-broad ClusterRoleBindings, use impersonation if API permissions weak.

Network (CNI)

• Controls: network policies (deny-by-default), egress controls, DNS policy, mTLS for cross-node, CNI hardening (no promiscuous bridge), segmentation between tenants.
• Pentest evaluation: map pod-to-pod connectivity, attempt lateral movement using allowed policies, DNS/tunneling exfiltration, ARP/IP spoofing on CNI bridge if accessible. Bypass: exploit overly permissive policies, leverage hostNetwork pods, or misconfigured network plugin to sniff/relay traffic.

Reporting/Recommendations (brief)

• For each finding: show PoC (kubectl/ssh commands, curl to API), privilege escalation path, CVE references, and prioritized mitigations (least privilege, patching, remove host sockets, tighten policies).